CVE-2021-21558
📋 TL;DR
CVE-2021-21558 is an information disclosure vulnerability in Dell EMC NetWorker backup software where local administrators can read LDAP credentials from local logs. This allows attackers with local admin access to potentially steal domain credentials and make unauthorized changes to the network domain. Affected systems include Dell EMC NetWorker versions 18.x through 19.4.0.1.
💻 Affected Systems
- Dell EMC NetWorker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain domain administrator privileges, compromise the entire Active Directory domain, exfiltrate sensitive data, and deploy ransomware across the network.
Likely Case
Local administrators escalate privileges to domain level, access sensitive systems, and potentially modify backup configurations to disrupt recovery capabilities.
If Mitigated
Limited to credential theft from logs without successful domain compromise due to strong access controls and monitoring.
🎯 Exploit Status
Exploitation requires existing local administrator access. Attack involves reading credentials from log files, which is straightforward for privileged users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to NetWorker 19.4.0.2 or later
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000186638/dsa-2021-104-dell-emc-networker-security-update-for-multiple-vulnerabilities
Restart Required: Yes
Instructions:
1. Download the latest NetWorker update from Dell support portal. 2. Backup current configuration. 3. Apply the patch following Dell's installation guide. 4. Restart NetWorker services. 5. Verify LDAP credentials are no longer logged in plaintext.
🔧 Temporary Workarounds
Restrict log file permissions
linuxSet strict permissions on NetWorker log files to prevent unauthorized reading
chmod 600 /path/to/networker/logs/*.log
chown root:root /path/to/networker/logs/*.log
Implement log monitoring and alerting
allMonitor access to NetWorker log files and alert on suspicious activity
🧯 If You Can't Patch
- Implement strict access controls to limit local administrator privileges on NetWorker systems
- Enable comprehensive auditing and monitoring of NetWorker log file access and LDAP credential usage
🔍 How to Verify
Check if Vulnerable:
Check NetWorker version via 'nsr_render_log' command or administration console. If version is 18.x through 19.4.0.1, system is vulnerable.Check Version:
nsr_render_log -VVerify Fix Applied:
After patching, verify version is 19.4.0.2 or later. Check that LDAP credentials are no longer visible in log files.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access to NetWorker log files
- LDAP authentication attempts from unusual locations
- Changes to domain configuration from NetWorker system
Network Indicators:
- LDAP queries from NetWorker systems to unusual domain controllers
- Unexplained domain policy changes
SIEM Query:
source="NetWorker" AND (event="log_access" OR event="ldap_auth") AND user="administrator"